fix(client): recover streamable HTTP session on 404 for session-bound requests

[Maverick-666]

Summary

Handle session-expired 404s in StreamableHTTPClientTransport when requests are session-bound.

What changed

• In send() (POST path), when a request is sent with mcp-session-id and receives 404:
  • clear internal session state
  • throw a recoverable SdkError tagged with sessionExpired: true
• In _startOrAuthSse() (GET path), apply the same 404 session-expiry handling.
• Added regression tests for both POST and GET session-bound 404 paths.
• Preserved existing behavior for non-session-bound 404 responses.
• Added a changeset patch for @modelcontextprotocol/client.

Why

Per MCP session management requirements, a 404 for a request carrying Mcp-Session-Id indicates an invalid/expired session. The client should not keep sending a stale session ID.

Testing

• pnpm --filter @modelcontextprotocol/client test -- test/client/streamableHttp.test.ts
• pnpm exec prettier --check packages/client/src/client/streamableHttp.ts packages/client/test/client/streamableHttp.test.ts .changeset/gentle-maps-smile.md

Closes #1708

[changeset-bot]

🦋 Changeset detected

Latest commit: d2d6587

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1718

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1718

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1718

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1718

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1718

commit: d2d6587

[felixweinberger]

Thanks for this. Could we simplify? The spec (Session Management, item 4) says:

When a client receives HTTP 404 in response to a request containing an MCP-Session-Id, it MUST start a new session by sending a new InitializeRequest without a session ID attached.

The transport's piece is "without a session ID attached". Clear _sessionId so the next request omits the header. Client.connect() already handles the re-init when transport.sessionId is undefined (client.ts:497).

Suggested minimal change (both _startOrAuthSse and send, before the existing throw):

if (response.status === 404 && this._sessionId !== undefined) {
    this._sessionId = undefined;
}